BIND DNS Servers Hit by 14 Security Flaws Enabling Cache Poisoning and Remote Crashes

Internet Systems Consortium has released security updates for BIND 9 after identifying 14 vulnerabilities that could allow attackers to poison DNS caches, crash exposed servers remotely, exhaust resources, or bypass DNSSEC protections.

Administrators running recursive BIND resolvers should apply the latest patched releases as soon as possible. The most serious issues affect the named daemon, which is widely used to provide authoritative and recursive DNS services across enterprise, ISP, and cloud environments.

Several of the flaws can be triggered by malicious DNS responses or specially crafted client queries, making internet-facing resolvers a key concern.

BIND DNS Servers Hit by Security Flaws

Two vulnerabilities directly address DNS cache-poisoning risks. CVE-2025-40778 covers multiple spoofing weaknesses that could let attackers insert forged records into a resolver cache when DNSSEC is not enabled, or validation is disabled.

ISC changed BIND so it no longer accepts DNAME records or unnecessary NS records in the authority section unless the response arrives through a spoofing-resistant mechanism, such as TCP, DNS Cookies, TSIG, or SIG(0).

CVE-2025-40780 affects BIND’s former pseudo-random number generator (PRNG), potentially allowing attackers to predict UDP ports and DNS transaction IDs and increase the chance of forged DNS responses.

ISC replaced the generator with a cryptographically secure pseudo-random generator to make prediction-based cache poisoning substantially harder.

Several fixes address remote denial-of-service issues, including CVE-2026-5947, which causes crashes from SIG(0)-signed responses under load, and CVE-2026-3593, a use-after-free flaw in DNS-over-HTTPS.

A flood of HTTP/2 SETTINGS frames could trigger the DoH issue while BIND was writing a DNS response, potentially causing named to crash.

Other flaws could terminate BIND during TKEY processing, malformed DNSSEC records, CNAME and DNAME handling, DNS64 operations, zone transfers, or specially constructed NSEC and NSEC3 responses.

In several cases, an attacker controlling an authoritative domain or DNS server could supply malformed records that trigger an assertion failure and cause the resolver process to exit.

The advisory set also includes resource-exhaustion protections. ISC added limits for excessive DNSSEC validation work, large nameserver lists, crafted negative responses, HTTPSSVCB alias processing, and cache growth scenarios. Such attacks could otherwise consume CPU or memory and delay legitimate DNS lookups.

Organizations should identify all systems running BIND, especially public recursive resolvers, DNS-over-HTTPS endpoints, DNSSEC-validating resolvers, and servers using DNS64, response policy zones, or dynamic updates.

Administrators should upgrade to a supported BIND release containing the fixes, review resolver exposure, restrict recursion to trusted clients, and monitor logs for unexpected named restarts, malformed-query errors, or abnormal CPU and memory usage.

The fixes underline that DNS infrastructure remains a high-value target: a successful cache-poisoning attack can silently redirect users to attacker-controlled systems, while remote crashes can disrupt essential network services.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC